Hi Justin. To clarify, from what I understand, October 28
is the date MongoHQ detected this. They've provided us
with the logs of database access, and unfortunately the
queries leading to our spam attack on Saturday started as
early as October 19.
Ouch -- Amazing how there is this ripple effect happening now that everone is using the cloud and there are so many middle men or service APIs. > In order to protect your data and users, we strongly urge you to secure each of these systems: > SSH keys uploaded to CircleCI > API tokens stored in CircleCI env vars > API/SSH key stored in a GitHub repo accessible from your CircleCI Interesting to note that Stripe and Ki…
> Interesting to note that Stripe and Kickstarter are customers. This is a little scary to think their source code could have been exposed, given the $$$ flowing through their systems. If either of them have any sense (which I think they do!) then having there source code exposed shouldn't in and of itself pose a security risk. If it did then that would be security via obscurity. Now I'm not saying that having the so…
Stripe is in the business of fraud detection, just as any other payment provider. Their source code likely contains lots of automated heuristics checking for fraudulent transactions, information which is tremendously useful for criminals looking to defraud people. No need for the "security by obscurity" reflex, because the problem at hand is impossible to solve completely.